An analyst suspects an active compromise on one endpoint. Which response balances immediate containment with evidence needs?

1. Follow the incident plan to isolate the endpoint and preserve relevant evidence
2. Broadcast unverified attribution to all customers
3. Leave it connected indefinitely to gather more data
4. Immediately erase the endpoint before any assessment